FAQ removed the trojan, but want to be sure.

Kylethedarkn · Apr 10, 2009

Ok so I had a trojan/virus that would keep me from running any anti-malware updates, it would redirect my uploads, downloads, and links, and it would crash my browser every once in a while.

I tried to do the FAQ steps right away but they failed, until I eventually used another computer to get the definition updates for mbam.

Ran everything. SuperAntiSpyware found nothing.

Mbam found the infected file and removed it.

Combofix found windows332ini.dll and deleted it

Don't know about MGtools - didn't look like anything was bad.

After all that the only thing that still happens is I will get this error from AVG occasionally, which is the error I would get when the trojan would redirect me:
http://i198.photobucket.com/albums/aa290/kylethedarkn/error.jpg

So could you guys check and make sure I'm clean. I was surprised by this infection, usually I can get rid of stuff in a matter of seconds using AVG, HJT, Killbox, and Unlocker, but this one was tricky.

And Thanks.

chaslang · Apr 13, 2009

Your logs are clean.

Kylethedarkn said: ↑

After all that the only thing that still happens is I will get this error from AVG occasionally, which is the error I would get when the trojan would redirect me:
Click to expand...

This is a bug in AVG that you will have to speak to them about.

Kylethedarkn · Apr 13, 2009

Ok, thank you for the lookover.

chaslang · Apr 16, 2009

You're welcome.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combofix folder from combofix (if it exists)

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Kylethedarkn · Apr 16, 2009

Yup Yup. Already done. I usually stay pretty clean too, this one just got to me by infecting me through temp files, from a forum that had gotten the virus.

Thanks once again.

chaslang · Apr 20, 2009

You're welcome. Surf safely!

Log in or Sign up

FAQ removed the trojan, but want to be sure.

Kylethedarkn Private E-2

Attached Files:

SASlog.txt

mbamlog.txt

ComboFix.txt

MGlogs.zip

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Kylethedarkn Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Kylethedarkn Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member